> They get paid regardless of whether a transaction is fraudulent or not, so they have no incentive to improve.

It doesn't take away from your main point, but credit card companies do have some incentive to improve. They want the customer not to be inconvenienced by having to report fraud in the first place, and they want to avoid having those people call the support staff. That's why banks monitor your activity and automatically decline transactions that seem fishy.